975f8a47bc86b60a12efccc60a2bb2f8e02bbb6cec78d918f26df82114870ca8

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe
Size 214KB
Sample240518-phzmgabc3v
SHA256 975f8a47bc86b60a12efccc60a2bb2f8e02bbb6cec78d918f26df82114870ca8
MD5 54b113a41ad2126cb2117b6a3e789cb2
SHA1 18199911c5c006a2d3598d8c85750133a5eb0f37
SHA512 009c65f9e721c3f9f6e2fc7431a482b48e5f30edd796341899cfd3d2e565a9ce32213a02e4a15f79127d9349e328d488a8a553fcc215df5de30c2ed1969d9070
SSDEEP 3072:sjdh27K4tfd81LgfoKO8DLxnYDgbACrs:snYFtdQ0nlhnDbFr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	1588	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1588	winver.exe
1588	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3484	Explorer.EXE
Token: SeCreatePagefilePrivilege	3484	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1588	winver.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3484	Explorer.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1588	3052	54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe	83
PID 3052 wrote to memory of 1588	3052	54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe	83
PID 3052 wrote to memory of 1588	3052	54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe	83
PID 3052 wrote to memory of 1588	3052	54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe	83
PID 1588 wrote to memory of 3484	1588	winver.exe	56
PID 1588 wrote to memory of 2760	1588	winver.exe	46

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2760

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3484
- C:\Users\Admin\AppData\Local\Temp\54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\54b113a41ad2126cb2117b6a3e789cb2_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 636
      4⤵
      Program crash
      PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1588 -ip 1588
1⤵
PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-8-0x00000000773A2000-0x00000000773A3000-memory.dmp

Download

memory/1588-7-0x0000000001390000-0x0000000001397000-memory.dmp

Download

memory/1588-14-0x0000000001390000-0x0000000001397000-memory.dmp

Download

memory/1588-4-0x0000000001390000-0x0000000001397000-memory.dmp

Download

memory/2760-12-0x0000000000380000-0x0000000000387000-memory.dmp

Download

memory/2760-13-0x0000000000380000-0x0000000000387000-memory.dmp

Download

memory/2760-16-0x00007FF8018D0000-0x00007FF8018D1000-memory.dmp

Download

memory/3052-2-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/3052-1-0x0000000000401000-0x0000000000405000-memory.dmp

Download

memory/3052-0-0x0000000000560000-0x0000000000572000-memory.dmp

Download

memory/3484-3-0x00000000021B0000-0x00000000021B7000-memory.dmp

Download

memory/3484-6-0x00000000021B0000-0x00000000021B7000-memory.dmp

Download

memory/3484-10-0x00007FF8018E0000-0x00007FF8018E1000-memory.dmp

Download

memory/3484-9-0x00007FF80174D000-0x00007FF80174E000-memory.dmp

Download